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SYSTEM DESCRIPTION 



The Department of State is an end user of the Paper Check Conversion System (PCC). PCC is a 
system owned and operated by the Department of the Treasury for use by many federal agencies. 
It converts personal and business checks into electronic funds transfers. The process occurs at the 
point of sale or in a lockbox environment. Transactions can be consumer, consumer accounts 
receivable, and business transactions. 

In the Department of State, PCC is used in both point of sale and lockbox environments. In point 
of sale environments, the paper checks are returned directly to the check writer after input to 
PCC. In lockbox environments, the paper checks are destroyed, usually thirty days after their 
input. 

PRIVACY IMPACT ASSESSMENT 

On the following pages is the latest PCC Privacy Impact Assessment published by the Financial 
Management Service of the Department of the Treasury. 
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Financial Management Service 



Privacy Impact Assessment Template 



A. SYSTEM APPLICATION/GENERAL INFORMATION: 

1) Does this system contain any information about individuals? 

Yes. 

a. Is this information identifiable to the individual 1 ? 

(If there is NO information collected, maintained, or used that is identifiable to the individual in 
the system, the remainder of the Privacy Impact Assessment does not have to be completed). 

Yes. 

Is the information about individual members of the public? 

(If YES, a PIA must be submitted with the OMB Exhibit 300, and with the IT Security C&A 
documentation). 

Yes. 

c. Is the information about employees? (If yes and there is no information about members of 
the public, the PIA is required for the FMS IT Security C&A process, but is not required to be 
submitted with the OMB Exhibit 300 documentation). 

No. 



2) What is the purpose of the system/application? 

The Paper Check Conversion Over the Counter (PCC OTC) program converts paper 
checks received into electronic debits to check writer's account through the Automated 
Clearing House system, or into a substitute check image that is truncated and cleared 
under the authority of Check 21. PCC OTC fully automates and improves the collection, 
reconciliation, research, and reporting processes associated with Federal agency over the 
counter check collections. 



B. DATA in the SYSTEM: 



1 "Identifiable Form" - According to the OMB Memo M -03-22, this means information in an IT system or online 
collection: (i) that directly identifies an individual (e.g., name, address, social security number or other identifying 
number or code, telephone number, email address, etc.) or (ii) by which an agency intends to identify specific 
individuals in conjunction with other data elements, i.e., indirect identification. (These data elements may include a 
combination of gender, race, birth date, geographic indicator, and other descriptors). 



1) What categories of individuals are covered in the system? 

Agency users, FRB-C users, FMS users. 

2) What are the sources of the information in the system? 

The digital image of the physical check submitted by the individual member of the public 
along with the information contained in the user defined fields. 

a. Is the source of the information from the individual or is it taken from 
another source? If not directly from the individual, then what other source? 

The source of the information is provided by the individual. 

b. What State and local agencies are providing data for use in the system? 

There are no state or local agencies providing data for this system. The system is only 
for Federal agencies. 

c. From what other third party sources will data be collected? 

No data will be collected from any third party source. 

d. What information will be collected from the employee and the public? 

Information will only be collected from the public and not employees. The public 
will submit checks to Federal agencies that will then, process those checks into 
the PCC OTC system. 

3) Accuracy, Timeliness, and Reliability 

a. How will data collected from sources other than FMS records be verified for 
accuracy? 

No data outside of FMS records is collected into the PCC OTC system. 

b. How will data be checked for completeness? 

There are image quality edits that aid in capturing a clean check image, which is used 
to ensure the data needed for check conversion is captured and complete. 

c. Is the data current? What steps or procedures are taken to ensure the data is 
current and not out-of-date? Name the document (e.g., data models). 

The Federal agencies using the system are required to maintain up to date internal 
operating procedures which should have steps in place to verify the data is current. 
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C. ATTRIBUTES OF THE DATA: 



1) Will the new data be placed in the individual's record? 

If the new data meets certain established criteria by the agency then it is possible that new 
data can be placed in the individual' s verification record. 

2) Can the system make determinations about employees/public that would not be 
possible without the new data? 

If the agency participates in the verification portion of the PCC system, then 
determinations regarding the check writer's check cashing privileges will be made 
using the new data. Depending on the agency check cashing policy the new data can be 
configured and tailored to meet the specific agency needs. The system will make a 
determination to process a check based on the agency needs and the new data in the 
verification record. 

3) If the data is being consolidated, what controls are in place to protect the data 
from unauthorized access or use? 

If agencies choose to share information on the verification database, the system access 
controls will still be applicable. The agency users will only have access to view the data 
belonging to their specific location to include the consolidated data from the shared 
agency. The Paper Check Security document details the strong system controls that are 
in place to protect the data from unauthorized access. 

4) What kinds of reports can be produced on individuals? What will be the use of 
these reports? Who will have access to them? 

There are no reports that can be run solely on an individual. 

5) What opportunities do individuals have to decline to provide 
information (i.e., where providing information is voluntary) or to consent to 
particular uses of the information (other than required or authorized uses), and 
how individuals can grant consent.) 

Individuals have the opportunity to opt out of having their check collected and the 
corresponding information made available to the agency by not submitting their check for 
collection at the point of sale. Individuals that submit their check through the mail can opt 
out of ACH check conversion. ACH opt out rules are stated in NACHA ACH rules 
Article two subsection 2.1.4. 
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D. MAINTENANCE AND ADMINISTRATIVE CONTROLS: 



1) Is the use of the data both relevant and necessary to the purpose for which the 
system is being designed? 

All of the data collected by the system is relevant and deemed necessary for the purpose 
of converting paper checks into electronic transactions. 

2) What are the retention periods of data in this system? 

The data will be retained for 7 years in the PCC system but may vary based on the 
agency requirements. 

3) How does the use of this technology affect public/employee privacy? 

The public is assured that a high degree of security is associated with Paper Check 
Conversion transactions, and that appropriate controls are in place to mitigate 
susceptibility to identify theft, hackers, phishers, and other compromises of their personal 
and bank account information. 

4) Will this system provide the capability to identify, locate, and monitor 
individuals? If yes, explain. 

The system does not allow access to users from the general public. However, the system 
administrator and end users (Agencies) have system access. The system utilizes security 
controls to track end users. The security controls will display all user activity within the 
system. 

5) What kinds of information are collected as a function of the monitoring of 
individuals? 

None, the information is only used for the processing of that actual item and not used for 
any monitoring purposes. 

6) Under which Privacy Act systems of records notice does the system operate? 
Provide number and name. 

The PCC OTC system is covered under the Systems of Record Notice published for 
collection systems for Treasury /FMS on February 4, 2003 at 68 FR 5691. The number 
this Systems of Records Notice is published under is Treasury/FMS.017. 

7) If the system is being modified, will the Privacy Act system of records notice 
require amendment or revision? Explain. 

No, the PCC OTC system will not be modified to perform in a manner beyond what has 
been identified in this document. 
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E. ACCESS TO DATA: 



1) Do other systems share data or have access to the data in the system? If yes, 
explain. 

No other systems share data or have access to the data in the PCC system. The PCC 
system does not have interfaces to other systems. 

2) Who is responsible for assuring proper use of the data? 

In accordance with TD P 25-07, the PCC OTC program manager is responsible for 
assuring the proper use of all data collected through, and maintained by the PCC OTC 
application. 



5 



